Splunk Enterprise Security
Monthly
Privilege escalation in Splunk Enterprise Security below 8.6.1 enables authenticated users holding the ess_analyst role to modify UEBA search macros that are subsequently executed by scheduled searches running under administrator permissions. The flaw stems from misconfigured UEBA app metadata that incorrectly grants analyst-tier write access to macros intended to be restricted to administrators, resulting in unauthorized access to all Splunk-indexed data and potential system integrity violations. No public exploit or CISA KEV listing exists at time of analysis, though the low barrier - any ess_analyst account - makes insider threat and compromised analyst credential scenarios credible attack paths.
SPL injection in Splunk Enterprise Security versions below 8.6.1 allows low-privileged authenticated users holding the mc_investigation_read capability to inject Search Processing Language through Analyst Queue search filter field names, gaining access to data and system integrity controls available to scheduled search contexts beyond their authorized scope. The root cause is absent validation of filter field names before inclusion in SPL queries - analogous to SQL injection but within Splunk's proprietary query language. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the CVSS 8.1 High score reflects meaningful confidentiality and integrity exposure for any account holding the relevant capability.
Privilege escalation in Splunk Enterprise Security below 8.6.1 enables authenticated users holding the ess_analyst role to modify UEBA search macros that are subsequently executed by scheduled searches running under administrator permissions. The flaw stems from misconfigured UEBA app metadata that incorrectly grants analyst-tier write access to macros intended to be restricted to administrators, resulting in unauthorized access to all Splunk-indexed data and potential system integrity violations. No public exploit or CISA KEV listing exists at time of analysis, though the low barrier - any ess_analyst account - makes insider threat and compromised analyst credential scenarios credible attack paths.
SPL injection in Splunk Enterprise Security versions below 8.6.1 allows low-privileged authenticated users holding the mc_investigation_read capability to inject Search Processing Language through Analyst Queue search filter field names, gaining access to data and system integrity controls available to scheduled search contexts beyond their authorized scope. The root cause is absent validation of filter field names before inclusion in SPL queries - analogous to SQL injection but within Splunk's proprietary query language. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the CVSS 8.1 High score reflects meaningful confidentiality and integrity exposure for any account holding the relevant capability.